Static Application Security Testing (SAST) is a foundational control in secure software delivery. However, the presence of a SAST tool alone does not constitute an effective control. Auditors, compliance officers, and regulators must assess whether the organisation’s SAST tool governance \u2014 from selection through ongoing operation \u2014 meets the standards required by frameworks such as DORA, NIS2, and ISO 27001.<\/p>\n\n\n\n
Ce guide fournit un cadre de v\u00e9rification structur\u00e9 pour \u00e9valuer la gouvernance des outils SAST dans les environnements d’entreprise et r\u00e9glement\u00e9s.<\/p>\n\n\n\n
Before assessing tool capabilities, auditors should verify that the organisation followed a governed tool selection process.<\/p>\n\n\n\n
Les auditeurs doivent v\u00e9rifier que l’outil SAST applique les politiques de s\u00e9curit\u00e9 de mani\u00e8re coh\u00e9rente et que la configuration des politiques est gouvern\u00e9e.<\/p>\n\n\n\n
Points de v\u00e9rification<\/strong><\/p>\n\n\n\n Auditor question:<\/strong> Can the organisation demonstrate who changed SAST policies, when, and why?<\/p>\n\n\n\n Auditors should verify that the SAST tool is embedded in the software delivery pipeline as an automated, enforceable control.<\/p>\n\n\n\n Points de v\u00e9rification<\/strong><\/p>\n\n\n\n Auditor question:<\/strong> Can the organisation demonstrate that SAST runs on every relevant pipeline execution, and that gaps are detected?<\/p>\n\n\n\n La gouvernance de la mani\u00e8re dont les r\u00e9sultats sont tri\u00e9s, supprim\u00e9s et r\u00e9solus est aussi importante que la capacit\u00e9 de d\u00e9tection de l’outil.<\/p>\n\n\n\n Points de v\u00e9rification<\/strong><\/p>\n\n\n\n Auditor question:<\/strong> Can the organisation produce a complete audit trail for any suppressed or accepted finding?<\/p>\n\n\n\n Les auditeurs doivent v\u00e9rifier que la couverture SAST est align\u00e9e avec le portefeuille applicatif et le profil de risque de l’organisation.<\/p>\n\n\n\n Points de v\u00e9rification<\/strong><\/p>\n\n\n\n Auditor question:<\/strong> Can the organisation demonstrate which applications are covered by SAST and which are not \u2014 and why?<\/p>\n\n\n\n Evidence generation is a primary audit focus area. Auditors should verify that the SAST tool and its surrounding processes produce reliable, tamper-resistant evidence.<\/p>\n\n\n\n Points de v\u00e9rification<\/strong><\/p>\n\n\n\n Auditor question:<\/strong> Can the organisation produce SAST evidence for any given release, tracing findings back to the specific commit and pipeline run?<\/p>\n\n\n\n Auditors should assess whether the organisation manages SAST tooling as a governed capability with a defined lifecycle, not as a one-time procurement decision.<\/p>\n\n\n\n Les cinq \u00e9tapes de la gouvernance des outils :<\/strong><\/p>\n\n\n\n Chaque \u00e9tape doit produire des preuves auditables. L’absence de toute \u00e9tape indique une lacune de gouvernance.<\/p>\n\n\n\n Les indicateurs suivants devraient susciter des pr\u00e9occupations lors d’un audit de la gouvernance des outils SAST :<\/p>\n\n\n\n SAST tool governance maps directly to requirements in major regulatory frameworks. Auditors should assess alignment with the following:<\/p>\n\n\n\n DORA (Digital Operational Resilience Act)<\/strong><\/p>\n\n\n\n NIS2 (Network and Information Security Directive)<\/strong><\/p>\n\n\n\n ISO 27001<\/strong><\/p>\n\n\n\n Auditing SAST tool governance requires looking beyond whether a tool is installed. Auditors should assess the full governance lifecycle \u2014 from selection through ongoing operation and review \u2014 and verify that the organisation produces the evidence required to demonstrate control effectiveness.<\/p>\n\n\n\n Organisations that treat SAST tool selection as a one-time procurement decision, rather than an ongoing governance responsibility, are likely to have gaps in coverage, evidence, and enforcement that expose them to regulatory and security risk.<\/p>\n\n\n\n Start with the tool selection process. Verify that a documented evaluation took place, that governance criteria (auditability, evidence generation, policy enforcement) were included, and that the decision was approved by appropriate stakeholders.<\/p>\n\n<\/div>\n<\/div>\n DORA requires documented evidence of ICT system testing, including code-level controls. NIS2 requires security measures in development processes. Governed SAST tooling \u2014 with evidence of consistent execution, policy enforcement, and periodic review \u2014 directly supports compliance with both frameworks.<\/p>\n\n<\/div>\n<\/div>\n The absence of periodic effectiveness review. Many organisations deploy a SAST tool and never reassess whether it continues to meet their security, compliance, and operational requirements \u2014 creating a gap between the control’s existence and its actual effectiveness.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n\n\n\n2. Gouvernance de l’int\u00e9gration CI\/CD<\/strong><\/h2>\n\n\n\n
\n
\n\n\n\n3. Gestion des r\u00e9sultats et qualit\u00e9 du signal<\/strong><\/h2>\n\n\n\n
\n
\n\n\n\n4. Gouvernance de la couverture et du p\u00e9rim\u00e8tre<\/strong><\/h2>\n\n\n\n
\n
\n\n\n\n5. Reporting, preuves et pr\u00e9paration \u00e0 l’audit<\/strong><\/h2>\n\n\n\n
\n
\n\n\n\nCycle de vie de la gouvernance des outils<\/strong><\/h2>\n\n\n\n
\n
\n\n\n\nSignaux d’alerte pour les auditeurs<\/strong><\/h2>\n\n\n\n
\n
\n\n\n\nAlignement r\u00e9glementaire<\/strong><\/h2>\n\n\n\n
\n
\n
\n
\n\n\n\nConclusion<\/strong><\/h2>\n\n\n\n
\n\n\n\nFrequently Asked Questions \u2014 SAST Tool Governance<\/h2>\n\n\n
What should auditors verify first when assessing SAST tool governance?<\/h3>\n
How does SAST tool governance relate to DORA and NIS2 compliance?<\/h3>\n
What is the most common governance gap in SAST tool management?<\/h3>\n
\n\n\n\nContenu associ\u00e9<\/strong><\/h2>\n\n\n\n